HTTP: Adobe Reader CVE-2014-0568 Sandbox Escape
This signature detects attempts to exploit a known flaw in Adobe Reader. An attacker can entice a user to load a malicious file which can result in sandbox bypass, possibly leading to further attacks.
Extended Description
The NtSetInformationFile system call hook feature in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows allows attackers to bypass a sandbox protection mechanism, and consequently execute native code in a privileged context, via an NTFS junction attack.
References
CVE: CVE-2014-0568
Short Name
HTTP:STC:ADOBE:CVE-2014-0568-SE
Severity
Critical
Recommended
False
Recommended Action
Drop
Category
HTTP
Keywords
Adobe CVE-2014-0568 Escape Reader Sandbox
Release Date
09/29/2014
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3761
False Positive
Unknown
CVSS Score
10.0